Validate 'next-action' header format in server action requests

[conico974]

Implement validation for the 'next-action' header format to ensure it meets the expected criteria before processing server action requests. This change enhances request handling by rejecting invalid formats early.

[linear]

RND-7824 Validate server actions headers

[changeset-bot]

⚠️ No Changeset found

Latest commit: 30fc171

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Summary of the deployments:

Version	URL	Status
Vercel	https://gitbook-v2-82ttq7f7p-gitbook.vercel.app	✅
Cloudflare	https://76550d08-gitbook-open-v2-preview.gitbook.workers.dev	✅

Test content

Site	2v	2c
GitBook	https://gitbook-v2-82ttq7f7p-gitbook.vercel.app/url/gitbook.com/docs	https://76550d08-gitbook-open-v2-preview.gitbook.workers.dev/url/gitbook.com/docs
E2E	https://gitbook-v2-82ttq7f7p-gitbook.vercel.app/url/gitbook.gitbook.io/test-gitbook-open	https://76550d08-gitbook-open-v2-preview.gitbook.workers.dev/url/gitbook.gitbook.io/test-gitbook-open

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
customers-v2 (Inspect)	✅ No changes detected	-	Aug 5, 2025, 8:18 AM
v2-cloudflare (Inspect)	👍 Changes approved	9 changed	Aug 5, 2025, 8:50 AM
v2-vercel (Inspect)	👍 Changes approved	8 changed	Aug 5, 2025, 8:23 AM

[Copilot]

Pull Request Overview

This PR implements validation for the 'next-action' header format in server action requests to ensure it meets the expected format before processing. The validation checks that the header matches a specific pattern (1-byte hex string followed by a 20-byte SHA1 hash).

• Adds regex validation to check 'next-action' header format against the expected 42-character hex pattern
• Returns early 400 response for invalid header formats
• Restructures the existing server action validation logic to accommodate the new header format check